The effect of PDP to organizational processes and performance: a case study - Gan, May Fen (2020)
With the increase of consumers’ privacy concerns and the government-enforced regulations on data protection, many countries have introduced personal data protection regulation to protect consumers’ personal data. Personal data protection (PDP) requires aspects of computerized and non-computerized system protection. For computerized systems, the use of technologies aims to protect personal data and privacy by addressing data minimization, anonymization, and pseudonymization. For non-computerized systems, employees experience changes in their work routine. In PDP, employees are the main stakeholders who directly involved in the data protection implementation and execution process through computerized and non-computerized systems. Due to the potential of employees’ work processes may be changed, it is important to understand employees’ perceptions on effective data protection through the changed work processes (either computerized or non-computerized) because their attitude can affect their intention to comply with data protection policy. Prior research has showed that human factors are one of the weakest links in protecting personal data and at the same time, they can be the most valuable assets in reducing personal data risk. With this indication, the components of people, computerized and non-computerized processes, and technologies are crucial in achieving effective organizational information security for personal data protection. Additionally, there is lack of prior studies on how personal data protection regulations affects employees’ working processes and their perceptions on effective PDP. Hence, the purpose of this research is to explore how personal data protection after Personal Data Protection Act (PDPA) enforcement affects employees’ work processes (either computerized or non-computerized) and their perception on data protection through the process changed. This research adopts a qualitative single case study to explore employees’ working processes and their perception on the effectiveness of personal data protection. Data were collected through in-depth interviews from respondents who were involved in data collecting, data processing, and data controlling in their daily tasks.